From 95b4b9e7472b0b71d9aef8b123d5245d8c607138 Mon Sep 17 00:00:00 2001 From: Robert Kaussow Date: Sat, 29 May 2021 13:45:35 +0200 Subject: [PATCH] initial commit --- .drone.jsonnet | 137 ++++++++++++++++++ .flake8 | 5 + .gitignore | 11 ++ .later.yml | 19 +++ .prettierignore | 1 + LICENSE | 21 +++ README.md | 10 ++ defaults/main.yml | 125 ++++++++++++++++ handlers/main.yml | 18 +++ meta/main.yml | 23 +++ molecule/centos7/converge.yml | 5 + molecule/centos7/create.yml | 120 +++++++++++++++ molecule/centos7/destroy.yml | 80 ++++++++++ molecule/centos7/molecule.yml | 22 +++ molecule/centos7/prepare.yml | 15 ++ molecule/centos7/tests/test_default.py | 11 ++ molecule/default | 1 + molecule/pytest.ini | 3 + molecule/requirements.yml | 6 + tasks/main.yml | 5 + tasks/prepare.yml | 23 +++ tasks/selinux.yml | 13 ++ tasks/setup.yml | 98 +++++++++++++ templates/conf/file_sd/sd.yml.j2 | 4 + templates/conf/prometheus.yml.j2 | 33 +++++ templates/conf/rules/alert.rules.j2 | 7 + .../etc/systemd/system/prometheus.service.j2 | 58 ++++++++ 27 files changed, 874 insertions(+) create mode 100644 .drone.jsonnet create mode 100644 .flake8 create mode 100644 .gitignore create mode 100644 .later.yml create mode 100644 .prettierignore create mode 100644 LICENSE create mode 100644 README.md create mode 100644 defaults/main.yml create mode 100644 handlers/main.yml create mode 100644 meta/main.yml create mode 100644 molecule/centos7/converge.yml create mode 100644 molecule/centos7/create.yml create mode 100644 molecule/centos7/destroy.yml create mode 100644 molecule/centos7/molecule.yml create mode 100644 molecule/centos7/prepare.yml create mode 100644 molecule/centos7/tests/test_default.py create mode 120000 molecule/default create mode 100644 molecule/pytest.ini create mode 100644 molecule/requirements.yml create mode 100644 tasks/main.yml create mode 100644 tasks/prepare.yml create mode 100644 tasks/selinux.yml create mode 100644 tasks/setup.yml create mode 100644 templates/conf/file_sd/sd.yml.j2 create mode 100644 templates/conf/prometheus.yml.j2 create mode 100644 templates/conf/rules/alert.rules.j2 create mode 100644 templates/etc/systemd/system/prometheus.service.j2 diff --git a/.drone.jsonnet b/.drone.jsonnet new file mode 100644 index 0000000..7eb7c0b --- /dev/null +++ b/.drone.jsonnet @@ -0,0 +1,137 @@ +local PipelineLinting = { + kind: 'pipeline', + name: 'linting', + platform: { + os: 'linux', + arch: 'amd64', + }, + steps: [ + { + name: 'ansible-later', + image: 'thegeeklab/ansible-later', + commands: [ + 'ansible-later', + ], + }, + ], + trigger: { + ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'], + }, +}; + +local PipelineDeployment(scenario='centos7') = { + kind: 'pipeline', + name: 'testing-' + scenario, + platform: { + os: 'linux', + arch: 'amd64', + }, + concurrency: { + limit: 1, + }, + workspace: { + base: '/drone/src', + path: '${DRONE_REPO_NAME}', + }, + steps: [ + { + name: 'ansible-molecule', + image: 'thegeeklab/molecule:3', + environment: { + HCLOUD_TOKEN: { from_secret: 'hcloud_token' }, + }, + commands: [ + 'molecule test -s ' + scenario, + ], + }, + ], + depends_on: [ + 'linting', + ], + trigger: { + ref: ['refs/heads/master', 'refs/tags/**'], + }, +}; + +local PipelineDocumentation = { + kind: 'pipeline', + name: 'documentation', + platform: { + os: 'linux', + arch: 'amd64', + }, + steps: [ + { + name: 'generate', + image: 'thegeeklab/ansible-doctor', + environment: { + ANSIBLE_DOCTOR_LOG_LEVEL: 'INFO', + ANSIBLE_DOCTOR_FORCE_OVERWRITE: true, + ANSIBLE_DOCTOR_EXCLUDE_FILES: 'molecule/', + ANSIBLE_DOCTOR_TEMPLATE: 'hugo-book', + ANSIBLE_DOCTOR_ROLE_NAME: '${DRONE_REPO_NAME#*.}', + ANSIBLE_DOCTOR_OUTPUT_DIR: '_docs/', + }, + }, + { + name: 'publish', + image: 'plugins/gh-pages', + settings: { + remote_url: 'https://gitea.rknet.org/ansible/${DRONE_REPO_NAME}', + netrc_machine: 'gitea.rknet.org', + username: { from_secret: 'gitea_username' }, + password: { from_secret: 'gitea_token' }, + pages_directory: '_docs/', + target_branch: 'docs', + }, + when: { + ref: ['refs/heads/master'], + }, + }, + ], + trigger: { + ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'], + }, + depends_on: [ + 'testing-centos7', + ], +}; + +local PipelineNotification = { + kind: 'pipeline', + name: 'notification', + platform: { + os: 'linux', + arch: 'amd64', + }, + clone: { + disable: true, + }, + steps: [ + { + name: 'matrix', + image: 'plugins/matrix', + settings: { + homeserver: { from_secret: 'matrix_homeserver' }, + roomid: { from_secret: 'matrix_roomid' }, + template: 'Status: **{{ build.status }}**
Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}
Message: {{ build.message }}', + username: { from_secret: 'matrix_username' }, + password: { from_secret: 'matrix_password' }, + }, + }, + ], + depends_on: [ + 'documentation', + ], + trigger: { + status: ['success', 'failure'], + ref: ['refs/heads/master', 'refs/tags/**'], + }, +}; + +[ + PipelineLinting, + PipelineDeployment(scenario='centos7'), + PipelineDocumentation, + PipelineNotification, +] diff --git a/.flake8 b/.flake8 new file mode 100644 index 0000000..b41e1fc --- /dev/null +++ b/.flake8 @@ -0,0 +1,5 @@ +[flake8] +ignore = D101, D102, D103, D105, D107, E402, W503 +max-line-length = 99 +inline-quotes = double +exclude = .git,.tox,__pycache__,build,dist,tests,*.pyc,*.egg-info,.cache,.eggs,env* diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d97b7cd --- /dev/null +++ b/.gitignore @@ -0,0 +1,11 @@ +# ---> Ansible +*.retry +plugins +library + +# ---> Python +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class + diff --git a/.later.yml b/.later.yml new file mode 100644 index 0000000..0efe5d5 --- /dev/null +++ b/.later.yml @@ -0,0 +1,19 @@ +--- +ansible: + custom_modules: + - iptables_raw + - openssl_pkcs12 + - proxmox_kvm + - ucr + - corenetworks_dns + - corenetworks_token + +rules: + exclude_files: + - molecule/ + - "LICENSE*" + - "**/*.md" + - "**/*.ini" + + exclude_filter: + - LINT0009 diff --git a/.prettierignore b/.prettierignore new file mode 100644 index 0000000..ef05acb --- /dev/null +++ b/.prettierignore @@ -0,0 +1 @@ +.drone* diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..8e54586 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2021 Robert Kaussow + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is furnished +to do so, subject to the following conditions: + +The above copyright notice and this permission notice (including the next +paragraph) shall be included in all copies or substantial portions of the +Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS +OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF +OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/README.md b/README.md new file mode 100644 index 0000000..629dd31 --- /dev/null +++ b/README.md @@ -0,0 +1,10 @@ +# xoxys.prometheus + +[![Build Status](https://img.shields.io/drone/build/ansible/xoxys.prometheus?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.prometheus) +[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?label=license)](LICENSE) + +Deploy Prometheus monitoring system. You can find the full documentation at [https://galaxy.geekdocs.de](https://galaxy.geekdocs.de/roles/cloud/prometheus/). + +## License + +This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details. diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..56724c0 --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,125 @@ +--- +prometheus_version: 2.27.0 +prometheus_user: "prometheus_adm" +prometheus_user_home: "/home/{{ prometheus_user }}" +prometheus_group: "{{ prometheus_user }}" +prometheus_extra_groups: [] + +prometheus_packages: [] + +prometheus_base_dir: "/opt/prometheus" +prometheus_config_dir: "{{ prometheus_base_dir }}/conf" +prometheus_rules_dir: "{{ prometheus_config_dir }}/rules" +prometheus_file_sd_dir: "{{ prometheus_config_dir }}/file_sd" +prometheus_data_dir: "{{ prometheus_base_dir }}/data" + +prometheus_web_listen_address: "0.0.0.0:9090" +prometheus_web_external_url: "" + +# @var prometheus_web_config:description: See official [documentation](https://github.com/prometheus/exporter-toolkit/blob/master/docs/web-configuration.md). +prometheus_web_config: + tls_server_config: {} + http_server_config: {} + basic_auth_users: {} + +prometheus_storage_retention: "30d" +prometheus_storage_retention_size: "0" +# @var prometheus_storage_retention_size:description: > __[EXPERIMENTAL]__ Maximum number of bytes that can be stored for blocks. +# Units supported: KB, MB, GB, TB, PB. +# @end + +prometheus_config_flags_extra: [] +# @var prometheus_config_flags_extra:example: > +# prometheus_config_flags_extra: +# - name: storage.tsdb.retention +# value: 15d +# - name: alertmanager.timeout +# - value: 10s +# @end + +prometheus_alertmanager_config: [] +# @var prometheus_alertmanager_config:example: > +# prometheus_alertmanager_config: +# - scheme: https +# path_prefix: alertmanager/ +# basic_auth: +# username: user +# password: pass +# static_configs: +# - targets: ["127.0.0.1:9093"] +# proxy_url: "127.0.0.2" +# @end + +prometheus_alert_relabel_configs: [] +# @var prometheus_alert_relabel_configs:example: > +# prometheus_alert_relabel_configs: +# - action: labeldrop +# regex: replica + +prometheus_global: + scrape_interval: 15s + scrape_timeout: 10s + evaluation_interval: 15s + +prometheus_remote_write: [] +# @var prometheus_remote_write:example: > +# prometheus_remote_write: +# - url: https://dev.kausal.co/prom/push +# basic_auth: +# password: FOO + +prometheus_remote_read: [] +# @var prometheus_remote_read:example: > +# prometheus_remote_read: +# - url: https://demo.cloudalchemy.org:9201/read +# basic_auth: +# password: FOO +# @end + +prometheus_external_labels: + environment: "{{ ansible_fqdn | default(ansible_host) | default(inventory_hostname) }}" + +prometheus_targets: [] +# @var prometheus_targets:example: > +# prometheus_targets: +# - name: node +# config: +# - targets: +# - localhost:9100 +# labels: +# env: test +# @end + +prometheus_scrape_configs: + - job_name: "prometheus" + metrics_path: "{{ prometheus_web_external_url | urlsplit('path') }}/metrics" + static_configs: + - targets: + - "{{ ansible_fqdn | default(ansible_host) | default('localhost') }}:9090" + +prometheus_alert_rules_files: + - "{{ prometheus_rules_dir }}/*.rules" + +prometheus_static_targets_files: + - prometheus/targets/*.yml + - prometheus/targets/*.json + +prometheus_alert_rules: + - alert: Watchdog + expr: vector(1) + for: 10m + labels: + severity: warning + annotations: + description: "This is an alert meant to ensure that the entire alerting pipeline is functional.\nThis alert is always firing, therefore it should always be firing in Alertmanager\nand always fire against a receiver. There are integrations with various notification\nmechanisms that send a notification when this alert is not firing. For example the\n\"DeadMansSnitch\" integration in PagerDuty." + summary: "Ensure entire alerting pipeline is functional" + - alert: InstanceDown + expr: "up == 0" + for: 5m + labels: + severity: critical + annotations: + description: "{% raw %}{{ $labels.instance }} of job {{ $labels.job }} has been down for more than 5 minutes.{% endraw %}" + summary: "{% raw %}Instance {{ $labels.instance }} down{% endraw %}" + +prometheus_alert_rules_extra: [] diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..5389c2d --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,18 @@ +--- +- name: Restart Prometheus Service + systemd: + name: prometheus + state: restarted + daemon_reload: yes + enabled: yes + listen: __prometheus_restart + become: True + become_user: root + +- name: Reload Prometheus Service + systemd: + name: prometheus + state: reloaded + listen: __prometheus_reload + become: True + become_user: root diff --git a/meta/main.yml b/meta/main.yml new file mode 100644 index 0000000..6981893 --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,23 @@ +# Standards: 0.2 +--- +galaxy_info: + # @meta author:value: [Robert Kaussow](https://gitea.rknet.org/xoxys) + author: "Robert Kaussow " + namespace: xoxys + role_name: prometheus + # @meta description: > + # [![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.prometheus) + # [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.prometheus?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.prometheus) + # [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?label=license)](LICENSE) + # + # Deploy Prometheus monitoring system. + # @end + description: Deploy Prometheus monitoring system + license: MIT + min_ansible_version: 2.10 + platforms: + - name: EL + versions: + - 7 + galaxy_tags: [] +dependencies: [] diff --git a/molecule/centos7/converge.yml b/molecule/centos7/converge.yml new file mode 100644 index 0000000..b12075b --- /dev/null +++ b/molecule/centos7/converge.yml @@ -0,0 +1,5 @@ +--- +- name: Converge + hosts: all + roles: + - role: xoxys.prometheus diff --git a/molecule/centos7/create.yml b/molecule/centos7/create.yml new file mode 100644 index 0000000..8b945cd --- /dev/null +++ b/molecule/centos7/create.yml @@ -0,0 +1,120 @@ +--- +- name: Create + hosts: localhost + connection: local + gather_facts: false + no_log: "{{ molecule_no_log }}" + vars: + ssh_port: 22 + ssh_user: root + ssh_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/ssh_key" + tasks: + - name: Create SSH key + user: + name: "{{ lookup('env', 'USER') }}" + generate_ssh_key: true + ssh_key_file: "{{ ssh_path }}" + force: true + register: generated_ssh_key + + - name: Register the SSH key name + set_fact: + ssh_key_name: "molecule-generated-{{ 12345 | random | to_uuid }}" + + - name: Register SSH key for test instance(s) + hcloud_ssh_key: + name: "{{ ssh_key_name }}" + public_key: "{{ generated_ssh_key.ssh_public_key }}" + state: present + + - name: Create molecule instance(s) + hcloud_server: + name: "{{ item.name }}" + server_type: "{{ item.server_type }}" + ssh_keys: + - "{{ ssh_key_name }}" + image: "{{ item.image }}" + location: "{{ item.location | default(omit) }}" + datacenter: "{{ item.datacenter | default(omit) }}" + user_data: "{{ item.user_data | default(omit) }}" + api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}" + state: present + register: server + loop: "{{ molecule_yml.platforms }}" + async: 7200 + poll: 0 + + - name: Wait for instance(s) creation to complete + async_status: + jid: "{{ item.ansible_job_id }}" + register: hetzner_jobs + until: hetzner_jobs.finished + retries: 300 + loop: "{{ server.results }}" + + - name: Create volume(s) + hcloud_volume: + name: "{{ item.name }}" + server: "{{ item.name }}" + location: "{{ item.location | default(omit) }}" + size: "{{ item.volume_size | default(10) }}" + api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}" + state: "present" + loop: "{{ molecule_yml.platforms }}" + when: item.volume | default(False) | bool + register: volumes + async: 7200 + poll: 0 + + - name: Wait for volume(s) creation to complete + async_status: + jid: "{{ item.ansible_job_id }}" + register: hetzner_volumes + until: hetzner_volumes.finished + retries: 300 + when: volumes.changed + loop: "{{ volumes.results }}" + + # Mandatory configuration for Molecule to function. + + - name: Populate instance config dict + set_fact: + instance_conf_dict: + { + "instance": "{{ item.hcloud_server.name }}", + "ssh_key_name": "{{ ssh_key_name }}", + "address": "{{ item.hcloud_server.ipv4_address }}", + "user": "{{ ssh_user }}", + "port": "{{ ssh_port }}", + "identity_file": "{{ ssh_path }}", + "volume": "{{ item.item.item.volume | default(False) | bool }}", + } + loop: "{{ hetzner_jobs.results }}" + register: instance_config_dict + when: server.changed | bool + + - name: Convert instance config dict to a list + set_fact: + instance_conf: "{{ instance_config_dict.results | map(attribute='ansible_facts.instance_conf_dict') | list }}" + when: server.changed | bool + + - name: Dump instance config + copy: + content: | + # Molecule managed + + {{ instance_conf | to_nice_yaml(indent=2) }} + dest: "{{ molecule_instance_config }}" + when: server.changed | bool + + - name: Wait for SSH + wait_for: + port: "{{ ssh_port }}" + host: "{{ item.address }}" + search_regex: SSH + delay: 10 + loop: "{{ lookup('file', molecule_instance_config) | from_yaml }}" + + - name: Wait for VM to settle down + pause: + seconds: 30 diff --git a/molecule/centos7/destroy.yml b/molecule/centos7/destroy.yml new file mode 100644 index 0000000..943c288 --- /dev/null +++ b/molecule/centos7/destroy.yml @@ -0,0 +1,80 @@ + +--- +- name: Destroy + hosts: localhost + connection: local + gather_facts: false + no_log: "{{ molecule_no_log }}" + tasks: + - name: Check existing instance config file + stat: + path: "{{ molecule_instance_config }}" + register: cfg + + - name: Populate the instance config + set_fact: + instance_conf: "{{ (lookup('file', molecule_instance_config) | from_yaml) if cfg.stat.exists else [] }}" + + - name: Destroy molecule instance(s) + hcloud_server: + name: "{{ item.instance }}" + api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}" + state: absent + register: server + loop: "{{ instance_conf }}" + async: 7200 + poll: 0 + + - name: Wait for instance(s) deletion to complete + async_status: + jid: "{{ item.ansible_job_id }}" + register: hetzner_jobs + until: hetzner_jobs.finished + retries: 300 + loop: "{{ server.results }}" + + - pause: + seconds: 5 + + - name: Destroy volume(s) + hcloud_volume: + name: "{{ item.instance }}" + server: "{{ item.instance }}" + api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}" + state: "absent" + register: volumes + loop: "{{ instance_conf }}" + when: item.volume | default(False) | bool + async: 7200 + poll: 0 + + - name: Wait for volume(s) deletion to complete + async_status: + jid: "{{ item.ansible_job_id }}" + register: hetzner_volumes + until: hetzner_volumes.finished + retries: 300 + when: volumes.changed + loop: "{{ volumes.results }}" + + - name: Remove registered SSH key + hcloud_ssh_key: + name: "{{ instance_conf[0].ssh_key_name }}" + state: absent + when: (instance_conf | default([])) | length > 0 + + # Mandatory configuration for Molecule to function. + + - name: Populate instance config + set_fact: + instance_conf: {} + + - name: Dump instance config + copy: + content: | + # Molecule managed + + {{ instance_conf | to_json | from_json | to_yaml }} + dest: "{{ molecule_instance_config }}" + when: server.changed | bool + diff --git a/molecule/centos7/molecule.yml b/molecule/centos7/molecule.yml new file mode 100644 index 0000000..f636281 --- /dev/null +++ b/molecule/centos7/molecule.yml @@ -0,0 +1,22 @@ +--- +dependency: + name: galaxy + options: + role-file: molecule/requirements.yml + env: + ANSIBLE_GALAXY_DISPLAY_PROGRESS: "false" +driver: + name: delegated +platforms: + - name: centos7-prometheus + image: centos-7 + server_type: cx11 +lint: | + /usr/local/bin/flake8 +provisioner: + name: ansible + env: + ANSIBLE_FILTER_PLUGINS: ${ANSIBLE_FILTER_PLUGINS:-./plugins/filter} + ANSIBLE_LIBRARY: ${ANSIBLE_LIBRARY:-./library} +verifier: + name: testinfra diff --git a/molecule/centos7/prepare.yml b/molecule/centos7/prepare.yml new file mode 100644 index 0000000..183f4d3 --- /dev/null +++ b/molecule/centos7/prepare.yml @@ -0,0 +1,15 @@ +--- +- name: Prepare + hosts: all + gather_facts: false + tasks: + - name: Bootstrap python for Ansible + raw: | + command -v python3 python || ( + (test -e /usr/bin/dnf && sudo dnf install -y python3) || + (test -e /usr/bin/apt && (apt -y update && apt install -y python-minimal)) || + (test -e /usr/bin/yum && sudo yum -y -qq install python3) || + echo "Warning: Python not boostrapped due to unknown platform." + ) + become: true + changed_when: false diff --git a/molecule/centos7/tests/test_default.py b/molecule/centos7/tests/test_default.py new file mode 100644 index 0000000..7339d3f --- /dev/null +++ b/molecule/centos7/tests/test_default.py @@ -0,0 +1,11 @@ +import os + +import testinfra.utils.ansible_runner + +import warnings +warnings.filterwarnings("ignore", category=DeprecationWarning) + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + diff --git a/molecule/default b/molecule/default new file mode 120000 index 0000000..2fdf3e8 --- /dev/null +++ b/molecule/default @@ -0,0 +1 @@ +centos7 \ No newline at end of file diff --git a/molecule/pytest.ini b/molecule/pytest.ini new file mode 100644 index 0000000..c24fe5b --- /dev/null +++ b/molecule/pytest.ini @@ -0,0 +1,3 @@ +[pytest] +filterwarnings = + ignore::DeprecationWarning diff --git a/molecule/requirements.yml b/molecule/requirements.yml new file mode 100644 index 0000000..46da115 --- /dev/null +++ b/molecule/requirements.yml @@ -0,0 +1,6 @@ +--- +collections: + - name: https://gitea.rknet.org/ansible/xoxys.general/releases/download/v2.1.1/xoxys-general-2.1.1.tar.gz + - name: community.general + +roles: [] diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..4502997 --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,5 @@ +--- +- include_tasks: prepare.yml +- include_tasks: setup.yml +- include_tasks: selinux.yml + when: ansible_selinux.status == "enabled" diff --git a/tasks/prepare.yml b/tasks/prepare.yml new file mode 100644 index 0000000..19a2cb9 --- /dev/null +++ b/tasks/prepare.yml @@ -0,0 +1,23 @@ +--- +- block: + - name: Create group '{{ prometheus_group }}' + group: + name: "{{ prometheus_group }}" + state: present + + - name: Create user '{{ prometheus_user }}' + user: + comment: Prometheus + name: "{{ prometheus_user }}" + home: "{{ prometheus_user_home }}" + group: "{{ prometheus_group }}" + groups: "{{ prometheus_extra_groups | join(',') }}" + + - name: Install dependencies + package: + name: "{{ item }}" + state: present + loop: + - "{{ prometheus_packages }}" + become: True + become_user: root diff --git a/tasks/selinux.yml b/tasks/selinux.yml new file mode 100644 index 0000000..6b710ff --- /dev/null +++ b/tasks/selinux.yml @@ -0,0 +1,13 @@ +--- +- block: + - name: Allow prometheus to bind to port in SELinux + seport: + ports: "{{ prometheus_web_listen_address.split(':')[1] }}" + proto: tcp + setype: http_port_t + state: present + when: + - ansible_version.full is version('2.4', '>=') + - ansible_selinux.status == "enabled" + become: True + become_user: root diff --git a/tasks/setup.yml b/tasks/setup.yml new file mode 100644 index 0000000..895478d --- /dev/null +++ b/tasks/setup.yml @@ -0,0 +1,98 @@ +--- +- name: Prepare base folder + file: + path: "{{ prometheus_base_dir }}" + state: directory + owner: "{{ prometheus_user }}" + group: "{{ prometheus_user }}" + mode: 0750 + become: True + become_user: root + +- block: + - name: Prepare folder structure + file: + path: "{{ item }}" + state: directory + mode: 0750 + loop: + - "{{ prometheus_config_dir }}" + - "{{ prometheus_rules_dir }}" + - "{{ prometheus_data_dir }}" + + - name: Download and extract Prometheus tarball + unarchive: + src: "https://github.com/prometheus/prometheus/releases/download/v{{ prometheus_version }}/prometheus-{{ prometheus_version }}.linux-amd64.tar.gz" + dest: "{{ prometheus_base_dir }}" + remote_src: yes + # include: + # - consoles/ + # - console_libraries/ + # - prometheus + # - promtool + notify: __prometheus_restart + + - name: Copy prometheus config file + template: + src: "conf/prometheus.yml.j2" + dest: "{{ prometheus_config_dir }}/prometheus.yml" + mode: 0640 + validate: "{{ prometheus_base_dir }}/promtool check config %s" + notify: __prometheus_reload + + - name: Copy prometheus web config file + copy: + content: "{{ prometheus_web_config | to_nice_yaml(indent=2) }}" + dest: "{{ prometheus_config_dir }}/web.yml" + mode: 0640 + + - name: Configure prometheus static targets + template: + src: "conf/file_sd/sd.yml.j2" + dest: "{{ prometheus_file_sd_dir }}/{{ item.name }}.yml" + mode: 0640 + loop: "{{ prometheus_targets }}" + + - name: Copy prometheus custom static targets + copy: + src: "{{ item }}" + dest: "{{ prometheus_file_sd_dir }}" + mode: 0640 + with_fileglob: "{{ prometheus_static_targets_files }}" + + - name: Configure prometheus alerting rules + template: + src: "conf/rules/alert.rules.j2" + dest: "{{ prometheus_rules_dir }}/default.rules" + mode: 0640 + validate: "{{ prometheus_base_dir }}/promtool check rules %s" + when: prometheus_alert_rules + prometheus_alert_rules_extra | length > 0 + notify: __prometheus_reload + + - name: Copy custom alerting rule files + copy: + src: "{{ item }}" + dest: "{{ prometheus_rules_dir }}/" + mode: 0640 + validate: "{{ prometheus_base_dir }}/promtool check rules %s" + with_fileglob: "{{ prometheus_alert_rules_files }}" + notify: __prometheus_reload + become: True + become_user: "{{ prometheus_user }}" + +- block: + - name: Copy systemd unit file + template: + src: "etc/systemd/system/prometheus.service.j2" + dest: "/etc/systemd/system/prometheus.service" + mode: 0640 + notify: __prometheus_restart + + - name: Ensure prometheus service is up and running + systemd: + name: prometheus + daemon_reload: yes + enabled: yes + state: started + become: True + become_user: root diff --git a/templates/conf/file_sd/sd.yml.j2 b/templates/conf/file_sd/sd.yml.j2 new file mode 100644 index 0000000..a1b03db --- /dev/null +++ b/templates/conf/file_sd/sd.yml.j2 @@ -0,0 +1,4 @@ +#jinja2: lstrip_blocks: True +{{ ansible_managed | comment }} + +{{ item.config | to_nice_yaml(indent=2) }} diff --git a/templates/conf/prometheus.yml.j2 b/templates/conf/prometheus.yml.j2 new file mode 100644 index 0000000..4cef2d3 --- /dev/null +++ b/templates/conf/prometheus.yml.j2 @@ -0,0 +1,33 @@ +#jinja2: lstrip_blocks: True +{{ ansible_managed | comment }} + +global: + {{ prometheus_global | to_nice_yaml(indent=2) | indent(2, False) }} + external_labels: + {{ prometheus_external_labels | to_nice_yaml(indent=2) | indent(4, False) }} +{% if prometheus_remote_write != [] %} + +remote_write: + {{ prometheus_remote_write | to_nice_yaml(indent=2) | indent(2, False) }} +{% endif %} +{% if prometheus_remote_read != [] %} + +remote_read: + {{ prometheus_remote_read | to_nice_yaml(indent=2) | indent(2, False) }} +{% endif %} + +rule_files: + - {{ prometheus_rules_dir }}/*.rules +{% if prometheus_alertmanager_config | length > 0 %} + +alerting: + alertmanagers: + {{ prometheus_alertmanager_config | to_nice_yaml(indent=2) | indent(2,False) }} + {% if prometheus_alert_relabel_configs | length > 0 %} + alert_relabel_configs: + {{ prometheus_alert_relabel_configs | to_nice_yaml(indent=2) | indent(2,False) }} + {% endif %} +{% endif %} + +scrape_configs: + {{ prometheus_scrape_configs | to_nice_yaml(indent=2) | indent(2,False) }} diff --git a/templates/conf/rules/alert.rules.j2 b/templates/conf/rules/alert.rules.j2 new file mode 100644 index 0000000..07b7ade --- /dev/null +++ b/templates/conf/rules/alert.rules.j2 @@ -0,0 +1,7 @@ +#jinja2: lstrip_blocks: True +{{ ansible_managed | comment }} + +groups: +- name: Ansible managed alert rules + rules: + {{ prometheus_alert_rules + prometheus_alert_rules_extra | to_nice_yaml(indent=2) | indent(2,False) }} diff --git a/templates/etc/systemd/system/prometheus.service.j2 b/templates/etc/systemd/system/prometheus.service.j2 new file mode 100644 index 0000000..cc24ae7 --- /dev/null +++ b/templates/etc/systemd/system/prometheus.service.j2 @@ -0,0 +1,58 @@ +{{ ansible_managed | comment }} +[Unit] +Description=Prometheus +After=network-online.target +Requires=local-fs.target +After=local-fs.target + +[Service] +Type=simple +Environment="GOMAXPROCS={{ ansible_processor_vcpus | default(ansible_processor_count) }}" +User={{ prometheus_user }} +Group={{ prometheus_group }} +WorkingDirectory={{ prometheus_base_dir }} +ExecReload=/bin/kill -HUP $MAINPID +ExecStart={{ prometheus_base_dir }}/prometheus \ + --storage.tsdb.path={{ prometheus_data_dir }} \ + --storage.tsdb.retention.time={{ prometheus_storage_retention }} \ + --storage.tsdb.retention.size={{ prometheus_storage_retention_size }} \ + --web.config.file={{ prometheus_config_dir }}/web.yml \ + --web.console.libraries={{ prometheus_base_dir }}/console_libraries \ + --web.console.templates={{ prometheus_base_dir }}/consoles \ + --web.listen-address={{ prometheus_web_listen_address }} \ + --web.external-url={{ prometheus_web_external_url }} \ +{% for flag in prometheus_config_flags_extra %} +{% if flag.value is not defined %} + --{{ flag.name }} \ +{% elif flag.value is string %} + --{{ flag.name }}={{ flag_value }} \ +{% elif flag.value is sequence %} +{% for flag_value_item in flag.value %} + --{{ flag.name }}={{ flag_value_item }} \ +{% endfor %} +{% endif %} +{% endfor %} + --config.file={{ prometheus_config_dir }}/prometheus.yml + +CapabilityBoundingSet=CAP_SET_UID +LimitNOFILE=65000 +LockPersonality=true +NoNewPrivileges=true +MemoryDenyWriteExecute=true +PrivateDevices=true +PrivateTmp=true +ProtectHome=true +RemoveIPC=true +RestrictSUIDSGID=true + +ReadWriteDirectories={{ prometheus_data_dir }} +{% for path in prometheus_read_only_dirs %} +ReadOnlyDirectories={{ path }} +{% endfor %} + +ProtectSystem=full +SyslogIdentifier=prometheus +Restart=on-failure + +[Install] +WantedBy=multi-user.target